You created a CA pool and CA in Certificate Authority Service and need to enable TLS inspection for Cloud NGFW Enterprise. What steps should you take?

To enable TLS inspection with Cloud NGFW Enterprise and Certificate Authority Service, the network security service agent requires the privateca.certificateRequester role to request certificates from the CA pool. A TLS inspection policy must then be created, linking to the CA pool to define how inspection occurs. This policy is then associated with specific VPC endpoints where TLS inspection is desired. Finally, the TLS inspection flag must be enabled within the relevant Cloud NGFW firewall policy rules to activate the inspection for matching traffic. The privateca.poolReader role is insufficient as it only allows reading CA pool details, not requesting certificates. Creating a trust config in Certificate Manager is not the correct mechanism for integrating with Cloud NGFW Enterprise TLS inspection; the dedicated TLS inspection policy is required.